Method of monitoring disturbances apt to occur at random or in bursts

ABSTRACT

A method using an algorithm-controlled monitoring of disturbances apt to occur at random or in bursts. Counting values are used for counting the disturbances. An abnormal event regarded to be a disturbance is first definded. Then, a base against which disturbances are to be counted is defined, followed by defining a unit to be used as a measure of a disturbance frequency. Values of the disturbance frequency are determined in a variety of circumstances, the values including a critical value fC of the disturbance frequency where the monitoring nominally issues an alarm. At the critical value there is determined a peakedness factor F that is a measure of how bursty the disturbances are. An inertia value J is chosen that is a measure of how fast or slowly the algorithm is desired to react to changes in the disturbance frequency, so as to achieve an acceptable compromise between speed and reliability of the monitoring.

This is a continuation of PCT application No. PCT/SE97/01765, filed Oct.22, 1997.

TECHNICAL FIELD OF THE INVENTION

The invention generally relates to the field of supervision ormonitoring of errors, or “disturbances”, in processes. As a specificfield in this regard performance management according to TMN(Telecommunications Management Networks) standards of telecommunicationoperations can be mentioned, cf. ITUT-T Recommendation M.3400.

More particularly, the invention relates to a method for performing, ina computer-controlled process, an algorithm-controlled monitoring ofdisturbances apt to occur at random or in bursts in the process, saidmonitoring using counting values obtained from a counter for countingsaid disturbances.

There are many examples of disturbances in a software-controlledtelecommunication system, among which can be mentioned parity errors,sporadic hardware faults, bit-correction errors, cyclic-redundancy-check(CRC) errors, congested call attempts, synchronization slip, protocolerrors, signalling errors in line or register signalling, programexception during run-time, violation of the software contract at aninterface.

There are also many cases of disturbance outside the field oftelecommunications, such as errors appearing when making a copy on aphotocopier, false results in a blood test, misfiring of aninternal-combustion engine, production faults in the manufacture of anelectronic component or of a printed-circuit board.

All such disturbances are unavoidable, and there is no reason tointervene for a single disturbance in order to find its cause. However,it is necessary to monitor automatically the disturbance rate orfrequency. If the disturbance frequency remains at a low predictable andacceptable level, this can be accepted. But if the rate of disturbancesrises to an unacceptable level, then the monitoring mechanism must raisean alarm, or send a notification, requesting manual intervention to findthe cause of the excess disturbances.

DESCRIPTION OF RELATED ART

In the field of telecommunications, a specific form of disturbancemonitoring has been known as “disturbance supervision”, as described inU.S. Pat. No. 5.377.195, and implemented in the Ericsson AXE 10 system.Currently, the expression “QOS measurement” (Quality-Of-Servicemeasurement) is used, as part of the performance management specified byTMN standards. QOS measurements do not consider the physical processesthat cause disturbances.

QOS measurements are well specified by the standards, cf. for example,ITU-T G.821 on #7 signalling, concerning error rates. However, there areno guidelines on how to set thresholds so as to obtain meaningfulresults. In practice, thresholds are set empirically. There is no methodfor setting thresholds in a systematic way. Often, the results from QOSmeasurements are so unreliable that they are worse than useless. Theygive false results, and can be such an irritant to maintenance personnelthat the measurements are turned off.

There are several possible algorithms that can be used in QOSmeasurements. One of these is the so-called Leaky Bucket algorithm. Thisalgorithm is potentially a well usable algorithm for QOS, but it isassociated with some problems which need to be solved. The mathematicalanalysis of the leaky bucket is not easy. There is too little knowledgeavailable about the behaviour of the disturbances that need to bemeasured by QOS. In practice, disturbances do not occur at random, whichis relatively easy to analyse, but in bursts, which is less easy. Asatisfactory solution to the problem requires that bursty behaviourshould be treated correctly. As the behaviour of QOS measurements isstochastic, no results are 100% reliable. There is always a risk offalse positive or false negative results. These risks must be taken intoconsideration when setting good values for the thresholds.

In fact there have seemed to be no satisfactory solutions available tothese problems.

SUMMARY

The method according to the invention, as defined by way ofintroduction, deals with the above discussed problems by comprising thesteps of

i) defining an abnormal event regarded to be a disturbance,

ii) defining a base against which disturbances are to be counted,

iii) defining a unit to be used as a measure of a disturbance frequency,

iv) determining values of the disturbance frequency in a variety ofcircumstances that can be expected in operation of a process generatingthe disturbance to be monitored, said values including a critical valuefC of the disturbance frequency where the monitoring nominally issues analarm,

v) determining for the process, at said critical value, a peakednessfactor F, being a measure of how bursty the disturbances are, as theratio of the variance to the mean of occurrences of disturbances in theprocess,

vi) choosing for the algorithm an inertia value J being a measure of howfast or slowly the algorithm is desired to react to changes in thedisturbance frequency, so as to achieve an acceptable compromise betweenspeed and reliability of the monitoring,

vii) calculating parameters for the monitoring based upon thedisturbance frequency value fC, the peakedness factor F and the inertiavalue J, and using said parameters to calculate according to 1/fC*J*F athreshold value T of the counter considered to be unacceptable,

iix) designing the algorithm for the monitoring with said parameters,

ix) initiating the monitoring and waiting for results thereof,

x) evaluating the results and, if necessary, adjusting the parameters.

In the above defined method the step of defining a base comprisesdetermining whether the base should be a unit of time, a base event, oran artificial base, the outcome being a random variable able to take avalue indicating normal event or disturbance.

In an important embodiment of the invention the condition is used thatthe disturbance frequency measured against all base events isindistinguishable from the frequency measured just against normalevents.

In a further embodiment of the invention, there is determined, besidesthe value of the critical frequency, the values of one or more of thefollowing further levels of the disturbance frequency:

fN=normal frequency in operation,

fR=raised frequency in operation, but one that is still acceptable,

fE=excessive frequency, at which the working of the equipment isdegraded,

fU=unacceptable frequency, where there are too many disturbances fornormal operation.

In a further very important embodiment of the invention the burstybehaviour is considered solely on the basis of the peakedness factor,together with the disturbance frequency.

In one embodiment of the invention, using the Leaky Bucket algorithm,the value for the inertia is used as a multiplier on the size of theleaky bucket.

A further embodiment of the method according to the invention includesthe step of producing a risk table including a number of columns, ofwhich four columns contain, in turn, level of disturbance frequency,bias, being expected change of a counter value after a base event, valueof the disturbance frequency, and risk of false result, respectively, byselecting a suitable set of values of the bias, calculating values ofthe disturbance frequency by adjusting the critical frequency with therespective values of the bias, and setting values for risks based uponmeasurements, economic analysis, experience, judgement or intuition.

In a further embodiment of the method according to the invention, thestep of evaluating the results comprises

a first substep of investigating whether measurements can be regarded asreliable, and, if yes, ending by taking no further action,

a second substep that, if the first substep reveals that measurementsare not reliable, comprises investigating three possible sources oferror, viz. whether 1) there are too many false alarms, 2) faultyequipment stays in service, or 3) the time to get results is too long,and

on a third substep level,

performing either of the following three steps,

(i) if there are too many false alarms, increasing the value of fC, orincreasing the value of J or F, by recalculating d and T and returningto first substep,

(ii) if faulty equipment stays in service without raising an alarm,reducing fC, or reducing J or F, recalculating d and T and returning tothe first substep,

(iii) if the time to get results is too long, reducing the value of J orF, recalculating d and T and returning to the first substep.

According to an important embodiment of the invention, the evaluatingstep includes a step of determining the probability of obtaining a falseresult in the monitoring, based upon using a Leaky Bucket algorithm inwhich said probability is defined as u(d,b,h,F), wherein

d=disturbance step is the amount by which a leaky bucket counter isincremented for each disturbance,

b=bias is the expected change of a counter value after a base event, b<0implying a false positive result obtained when alarm is given, eventhough there is nothing wrong with a supervised object, and b>0 implyinga false negative result obtained when no alarm is given, even thoughthere is something wrong with the supervised object,

h=size of the bucket, measured in units of the disturbance step,

F=peakedness factor for the disturbance process.

In the above connection, the step of determining the probability ofobtaining a false result can include the substeps of

entering as parameters:

disturbance step d, bias b and size h of bucket, initializing asvariables:

r=P{normal event}/P{disturbance}, wherein P{normal event} meansprobability of a normal event appearing and P{disturbance} meansprobability of a disturbance appearing,

a=h*d being size of the bucket in units of 1, determining whether biasb=0, <0 or >0,

calculating, if bias=0, boundaries of probability u(a/2), while usinginequality$\frac{\left( {a - z} \right)}{a}<={u(z)}<=\frac{\left( {a + d - z - 1} \right)}{\left( {a + d - 1} \right)}$

wherein u(z) means probability of hitting the floor of the bucket, givenstarting point z,

producing upper and lower bounds, and average for the probabilityu(a/2),

solving with binary search, if bias is not =0, the equationf(s)=r+s**(d+1)−(r+1)*s=0, in either the range 1<s<2 for b<0, or in therange 0<s<1 for b>0, wherein s is a dummy variable,

calculating boundaries of probability u(a/2) using inequality$\frac{\left( {s^{a} - s^{z}} \right)}{\left( {s^{a} - 1} \right)}<={u(z)}<=\frac{\left( {s^{({a + d - 1})} - s^{z}} \right)}{\left( {s^{({a + d - 1})} - 1} \right)}$

producing upper and lower bounds, and average, for probability u(a/2)

The step of determining the probability of obtaining a false result caninclude the substeps of

entering as parameters:

disturbance step d, bias b, peakedness F and size h of bucket,

initializing as variables:

a state transition probability matrix: $\begin{matrix}{{base}\quad {event}} & {{X\left( {n + 1} \right)} =} & \quad & 0 & 1 \\{{base}\quad {event}} & {{X(n)} =} & \begin{matrix}0 \\1\end{matrix} & \begin{matrix}\left\lbrack p \right. \\\left\lbrack Q \right.\end{matrix} & \begin{matrix}\left. q \right\rbrack \\\left. P \right\rbrack\end{matrix}\end{matrix}$

 where:

P>q and Q<p;

p=P{X(n)=normal event, 0 & X(n+1)=normal event, 0},

q=P{X(n)=normal event, 0 & X(n+1)=disturbance, 1},

Q=P{X(n)=disturbance, 1 & X(n+1)=normal event, 0},

P=P{X(n)=disturbance, 1 & X(n+1)=disturbance, 1};

the steady-state probabilities for the two-state model are:

x=P{x(n)=0}=Q/(Q+q)

y=P{x(n)=1}=q/(Q+q)

 probability distribution for time=0, performing in a loop through timet while weight ˜>0.000001, weight being the probability of the counterremaining between the boundaries of the bucket, the substeps of

 calculating probability P{state=0 & counter=i} at time=t+1,

 calculating probability P{state=1 & counter=i} at time=t+1,

 calculating probability P{counter hitting floor or ceiling} attime=t+1,

 calculating component of mean and mean square for duration ofmeasurement at time =t+1,

 calculating weight, preparing for the next iteration of the loop byshifting values, and ending loop,

 calculating variance and standard deviation of duration for themeasurement,

 producing probability of hitting floor and hitting ceiling,

 producing mean and standard deviation of duration.

BRIEF DESCRIPTION OF THE DRAWINGS

The invention will now be described more closely with reference to theaccompanying drawings, on which

FIG. 1 is a block diagram schematically illustrating a basic frameworkof the method according to the invention,

FIG. 2 is a schematical flow chart illustrating generally the methodaccording to the invention in ten steps,

FIG. 3 is an arbitrary risk table to be used in connection with step 6of the flow chart according to FIG. 2,

FIG. 4 is a schematical subflow chart of step 10 of the flow chartaccording to FIG. 2,

FIG. 5 is a schematical flow chart illustrating use of the ten stepsaccording to FIG. 1 for applying the method according to the inventionon a malfunctioning photocopier,

FIG. 6 is a risk table to be used in connection with step 6 of the flowchart according to FIG. 5,

FIGS. 7a and 7 b are flow charts illustrating respective solutions of aprobability function providing the probability of a false result in aQOS measurement for which the Leaky Bucket algorithm is used inconnection with the method according to the invention,

FIG. 8 is a table providing a comparison of the two solutions accordingto FIGS. 7a and 7 b of the probability function.

DETAILED DESCRIPTION OF EMBODIMENTS

The invention is basically a method for performing, in acomputer-controlled process, an algorithm-controlled monitoring orsupervision of disturbances apt to occur at random or in bursts in theprocess. For the supervision, counting values obtained from a counterfor counting said disturbances are used. FIG. 1 illustrates in blockdiagram form the interrelationship between a process 102 exposed todisturbances, also referred to below as “disturbance process”, functions104 for monitoring or supervising disturbances apt to occur in theprocess 102, and alarm functions 106.

For each disturbance, the disturbance process 102 informs the thefunctions 104 by a disturbance signal, indicated by arrow 108. For eachnormal event in the disturbance process, the functions 104 are informedby a normal event signal, indicated by arrow 110.

When the monitoring functions 104 determine that a disturbance frequencyis “too high” in some sense, the alarm functions 106 are informed by analarm signal, indicated by arrow 112, from the monitoring functions 104.A block 114 indicates one or more counters in the monitoring functions104 for counting the disturbances. If and when the disturbance frequencydrops to an acceptable level, the alarm functions 106 are informed by analarm end signal, indicated by arrow 116, from the monitoring functions104.

The invention will now be described more in detail by way ofembodiments. These embodiments will essentially be based upon thepresumption that the algorithm used for QOS measurements will be theleaky bucket algorithm, henceforth also shortly referred to as “leakybucket”, or just “bucket”.

Mathematical notations used below will include conventional notations,though some variables contain two or more alphanumeric characters, as iscommon practice within programming. For the most complicated mathematicsmathematical notation is used. Otherwise, in running text, computingconventions are used, in particular slash is used for division, asteriskfor multiplication, and double asterisk for exponent. Parentheses areused for indexing. P{ } is commonly used to denote probability.Consistent use has been made of single-letter variables, for example, dfor disturbance step. There are only minor exceptions.

FIG. 2 is a flow chart in the form of a block diagram schematicallyillustrating the method according to the invention when used togetherwith the leaky bucket algorithm.

A first step 202 is to define the abnormal event that is regarded as adisturbance, e.g. a bit error or a failed call. This step can beperformed as described in U.S. Pat. No. 5,377,195 referred to earlier,and included herein by reference.

The next step, indicated at 204, is to define a base against whichdisturbances are counted.

The base can be:

Unit of time, e.g. the duration of one bit. A time-based disturbanceprocess is called a “regular” disturbance process in the U.S. Pat. No.5,377,195. Traditionally, the leaky bucket is used for time-baseddisturbance processes.

Base event, e.g. a call attempt. An event-based disturbance process iscalled an “irregular” disturbance process in the U.S. Pat. No.5,377,195.

The concept of base event is used here in essentially the same way as inU.S. Pat. No. 5,377,195, although here the distinction between normalevent and base event is made clear.

An artificial base, such as a unit of traffic-volume, e.g. anerlang-second.

In all three cases the outcome is a random variable X, which can takethe values:

0=normal event, with probability, say x, and

1=disturbance, with probability, say y=1−x.

In the third step, indicated at 206 in FIG. 2, the unit with which tomeasure disturbance frequency is defined. Once the disturbance and thebase are defined, according to the first and second steps, units havebeen found in which to measure the disturbance frequency, e.g.proportion of bit errors for a time-based disturbance process,percentage of failed calls for an event-based disturbance process, orproportion of errored seconds during speech for a traffic-baseddisturbance process.

It should be noted that the disturbance frequency y mentioned above, isassumed to be low, typically less than one percent. This means that thedisturbance frequency measured against all base events, includingdisturbances, is indistinguishable from the frequency measured againstjust normal events, excluding disturbances. It is impossible to measurethe difference between the two in practice, and the discussion belowwill swap between the two definitions when mathematically convenient. Inother words, y is indistinguishable from y/x, when y<<1. Thisapproximation will here be called the “disturbance approximation”. Thus,the disturbance approximation is a mathematical approximation accordingto which the disturbance frequency measured against all base events isindistinguishable from the frequency measured just against normalevents.

In the fourth step, indicated at 208 in FIG. 2, the disturbancefrequency is estimated or measured in a variety of circumstances thatcan be expected in operation for the disturbance process beingmonitored. The disturbance frequency can be measured either directly bymeans of some apparatus, or by use of experience and intuition.

In particular, there are five values of disturbance frequency that canbe of interest:

fN=normal frequency in operation, for example 0.5%,

fR=raised frequency in operation, but one that is still acceptable, forexample 0.8%,

fC=critical frequency, at which the measurement nominally issues analarm or a notification, for example 1.0%,

fE=excessive frequency, at which the working of the equipment isdegraded, for example 1.25%,

fU=unacceptable frequency, where there are too many disturbances fornormal operation, for example, 2%.

In the fifth step, indicated at 210 in FIG. 2, the peakedness factor forthe process that generates disturbances is estimated or measured.Peakedness is a measure of how bursty the disturbance process is. Thepeakedness factor is defined by ITU-T, cf. CCITT, HANDBOOK ON QUALITY OFSERVICE AND NETWORK PERFORMANCE, Geneva, 1993, ISBN 92-61-04741-6, Rec.E.600, to be the ratio of the variance to the mean of a random variable.For example, if Y is the sum of many random variables X(i), where X(i)is distributed as X above, and if. further the variables X(i) arecorrelated, then the variance of Y will in general be inflated by aconstant factor, known as peakedness.

Essentially, the peakedness factor can vary with the disturbancefrequency. However, the only peakedness being of interest here is thepeakedness at the frequency fC. There are many ways of measuring thepeakedness of a disturbance process, depending on what is known orassumed about the process. The most important methods to be used inconnection with the method according to the invention are summarizedbelow:

If disturbances occur singly, and at random, then F=1.

If disturbances occur in a fixed number n in any burst, where the burstsoccur at random, then F=n.

If the number of disturbances in any such random burst is geometricallydistributed with mean m, then F=2m−1.

If the disturbances follow the two-state model described in U.S. Pat.No. 5,377,195, then F=determinant of the state matrix.

If the number of disturbances in any burst is distributed with mean mand variance V, and the bursts occur at random, then F=m+V/m.

If the correlation coefficient between the results of successive baseevents is c, then F=(1+c)/(1−c).

If the inter-arrival times of disturbances, measured against the baseevent, have variance V, and mean m, then F=V/(m**2), cf. “Analysis ofNon-Poisson Disturbance Processes” (Chapter 2), Anna Gyllenstierna,(Master's Thesis at Ericsson Telecom, 1992). For example, ifdisturbances occur singly and fairly regularly, then F <1.

If the disturbances follow the three-state model or the Gilbert-Elliottmodel, then the peakedness can be calculated here too, cf. again thereference by Anna Gyllenstierna just mentioned. For example, using theresults quoted for the three-state model in “Simulation of Burst-ErrorModes and an Adaptive Error-Control Scheme for High-Speed DataTransmission over Analog Cellular Systems”, Takuro Sato and others(IEEE, May 1991), then F typically takes the value of 20 or more for biterrors in data transmission over analogue cellular systems.

Using one or more of the methods above, the peakedness at the criticalfrequency can be either measured explicitly, or estimated by means ofjudgement and experience.

There are many models of varying complexity and validity, which describethe behaviour of a bursty disturbance process. The more complex themodel, the more difficult it is to estimate the parameters for aparticular disturbance process with any degree of reliability.

According to one essential feature of the invention a peakednesshypothesis is used that states that the only relevant information aboutthe bursty behaviour of a disturbance process is contained within thevalue of the peakedness factor, together with the disturbance frequency.It is most likely that this hypothesis is valid for all practicalpurposes.

In the sixth step, indicated at 212 in FIG. 2, a value is chosen for theinertia of the leaky bucket algorithm. By inertia is here meant ameasure of how fast or slowly the algorithm reacts to changes in thedisturbance frequency, and is used as a compromise between reliabilityand reactivity for the QOS measurements. On the one hand, a small valueof the inertia means that the algorithm reacts quickly, but at the priceof many false results. On the other hand, a large value of the inertiagives reliable results, but at the price of taking a long time. Thus, adefinition of “inertia” in the present context is that it is amultiplier on the size of the leaky bucket, a small value of the inertiagiving fast, unreliable results, whereas a large value gives slow,reliable results.

Thus, no matter how well any QOS measurement is specified and designed,there is always a risk of a false result. A false positive can beobtained when a QOS alarm or notification is given, even though there isnothing wrong with the supervised object. A false negative can beobtained when no QOS alarm or notification is given, even though thereis something wrong with the supervised object.

In general, if there are many supervised objects, which are not criticalto the operation of the system, then false positives are the problem.The operational staff get irritated by false positives, and may tend toignore them. In that case, the parameters for the QOS measurement mustbe chosen to give a low risk of false positives. However, the price ofthis decision is that the measurement reacts slowly when the supervisedobject genuinely causes too many disturbances. This case will bereferred to below as case A.

On the other hand, if there are few supervised objects, which arecritical to the operation of the system, it is important that the QOSmeasurements react quickly when the supervised objects cause too manydisturbances. The price of this decision is that there will be asignificant number of false positives. This case will be referred tobelow as case B.

The purpose of step 212 is to choose a value for the inertia whichachieves a reasonable compromise between the conflicting goals ofsignificance of results and speed at which results are obtained.

In order to obtain a qualitative understanding of the loss function,risks to obtain a false result are presented in the table according toFIG. 3.

At this stage, there exists a lot of information about the disturbancefrequency, and the consequences of a false result, or of delay inobtaining results. This information may be very exact, or theinformation may be less precise, and based on intuition and experience.

In any event, a risk table of the kind indicated in FIG. 3 needs to befilled in. The four columns of the table indicate, in turn, level ofdisturbance frequency, bias, value of the disturbance frequency and riskof false result, respectively, bias being the expected change of acounter value after a base event. The values in columns 2-4 may beregarded as a typical set of values to illustrate the discussion.

In principle, any suitable set of values for the bias can be chosen.However, the values given in the table of FIG. 3 are both intuitive andeasy to manage. The values of the disturbance frequency are thencalculated by adjusting the critical frequency with the respectivevalues of the bias. The values for the risks are then set based uponeconomic analysis, experience, judgement or intuition.

When this table has been filled in, the biases and the risks should becompared with the values for the bias, b, and the risk, u, appearing inthe table according to FIG. 8, to be described in detail later on. Thena suitable value for the height h should be chosen, bearing in mind thath=J*F, where J=inertia and F=peakedness. In this example, we can seethat the value J=10 matches the risks very well. If the table accordingto FIG. 8 should not give sufficient guidance, then one or both of twomethods to be described later on with reference to FIGS. 7a, 7 b andwritten programs denominated “BUCKET” and “CLOUD” should be used. Astudy of table 8 shows that 20 is a high value of J (case A), 5 is a lowvalue of J (case B) and 10 is an intermediate value.

In the seventh step, step 214 in FIG. 2, the parameters for the leakybucket are calculated. This step comprises two substeps. The firstsubstep sets disturbance step d=1/fC, where fC is the critical frequencyat which the QOS measurement nominally raises an alarm. Using the valuesin the table according to FIG. 3, d=100. The second substep sets thesize of the leaky bucket, or threshold, T, to d*J*F, where J=inertia andF=peakedness as indicated above. Using the values in the table of FIG.3, T=2000, assuming a peakedness of 2.

In the eighth step, step 216 in FIG. 2, the leaky bucket is designed forQOS measurements. This step is relatively straightforward. U.S. Pat. No.5,377,195 describes one way.

In the ninth step, indicated at 218 in FIG. 2, the QOS measurements areput into operation, e.g. by using the leaky bucket. By this is justmeant initiating the measurements, and waiting for the results.

In the tenth step, indicated at 220, the results are evaluated and, ifnecessary, the parameters are adjusted. There will be operationalexperience of the measurements after a few days or weeks. Withoutdescribing in detail how to evaluate the results, and referring to theflow chart of FIG. 4, it is likely that one of the following cases ofconclusions and corresponding actions will appear.

In FIG. 4, step 402 starts by investigating whether measurements can beregarded as reliable. If yes, the process ends in block 404 indicatingthat no action is taken. By the measurements being reliable is meantthat any alarms raised are significant in that they identify faultyequipment and that there is no evidence of faulty equipment that doesnot raise an alarm.

If no in step 402, the process proceeds to step 405 to determine what iswrong. Three possible sources of error are investigated, viz. whether 1)there are too many false alarms, 2) faulty equipment stays in service,or 3) the time to get results is too long.

If, in step 405, the number of false alarms is found to be such that itcan be regarded as not acceptable, the process proceeds, arrow 406, totaking actions according to block 408. By a false alarm is meant that nofault can be found on an indicated equipment. These actions consist inincreasing the value of fC, or increasing the value of J or F, followedby recalculating d and T. The process then returns to step 402 accordingto arrow 410.

If, in step 405, it is found that there is clear evidence that faultyequipment stays in service without raising an alarm, the processproceeds, arrow 412, to taking actions according to block 414. Theseactions consist in reducing fC, or reducing J or F, followed byrecalculating d and T. The process then returns to step 402 according toarrow 416.

If, in step 405, it is found that the time for getting any results fromthe QOS measurements can be regarded as unacceptably long, the processproceeds, arrow 418, to taking actions according to block 420,consisting in reducing J or F followed by recalculating T. The processthen returns to step 402 according to arrow 422.

An example consisting in dealing with the problems of a malfunctioningphotocopier following similar steps as in FIG. 2, will now be describedwith reference to FIG. 5, showing a flow chart in the form of a blockdiagram.

Many people have experienced the frustration of using a malfunctioningphotocopier. Yet, even a malfunctioning machine only fails sometimes,and not every time it makes a copy.

As a first step, block 502, the disturbance is defined to be a failureto make a copy. Or more exactly, the machine stops and gives a faultcode that requires manual intervention.

In the next step, block 504, the base event is defined to be an attemptto make a single copy of a single sheet. The QOS measurement istherefore event-based.

In the third step, block 506, the unit for disturbance frequency isdefined as being the proportion, or percentage, of failed copyingattempts.

As a fourth step, block 508, the disturbance frequency is measured. Thiscan be done in a copying room, by counting the number of times manualintervention was needed, and dividing it by the number of sheets copiedin the same period. On the basis of experience, the following values offrequency seem reasonable: fN=0.05%, fR=0.08%. fC=0.1%, fE=0.125%, andfU=0.2%.

As a fifth step, block 510, the peakedness is measured. Peakedness canbe measured experimentally in the copying room. However, a value of F=3is chosen intuitively, on the basis that a photocopier often fails acouple of times in a short period, and then continues to functionnormally again.

In the sixth step, block 512, a value for the inertia is chosen. Theprocedure is started by choosing a loss function. Reasonable costs areone dollar for each disturbance, and 100 dollars for each false alarm.Without analysing the loss function in detail, a suitable risk table canbe the one shown in FIG. 3.

Comparing the values in this table with the values in the tableaccording to FIG. 8, it can be seen that J=5, is a suitable value forthe inertia.

In the seventh step, block 514, the parameters are calculated.Disturbance step d=1/fC=1000. Threshold T=d*J*F=1000*5*3=15000.

In the following step, block 516, the QOS measurement is designed. Thisis straightforward, and can be as described in U.S. Pat. No. 5,377,195.The leaky bucket algorithm should be designed into the microprocessor inthe photocopier. It should be designed, so that each time the bucketempties, i.e. a negative result, the measurement is restarted. If thebucket overflows, i.e. a positive result, a signal is sent automaticallyto a maintenance centre. It is a matter of choice whether the machineshould be taken out of operation or not. A likely solution is that themachine is left in operation, but with a warning light, saying that itis malfunctioning, and that maintenance has been requested.

In the ninth step, block 518, the QOS measurement is put into operation.In this case, install the copying machine, and start using it.

In step 10, block 520, the results are evaluated. If the results of themeasurements are satisfactory, nothing has to be done. The maintenanceengineer is only called when the operation statistics genuinely are bad.However, if there is a clear problem with false positives or negatives,then the numbers above must be adjusted until the; results aresatisfactory as has been explained with reference to FIG. 4.

The most important advantage of the invention is that QOS measurementswill provide meaningful results that justify the expense of designingthem and putting them into operation. Generally, this does not seem tobe true for prior art systems.

Above, embodiments of the invention have been described in connectionwith using the leaky bucket algorithm in QOS measurements. There areother algorithms in use today, with relative strengths and weaknesses.These algorithms share the problem in setting thresholds to meaningfulvalues.

The invention is intended primarily for automatic monitoring orsupervision of disturbances within modern telecommunications. However,the invention is just as applicable to other areas of QOS measurements,such as manufacture of printed-circuit boards.

Above it has been assumed that the disturbance approximation should bevalid only for low frequency disturbances. However, empirical resultsfrom leaky bucket analysis suggest that this assumption is notnecessary, but that the results can be extended also to high-frequencydisturbances. There are some important examples of high-frequencydisturbances, such as manufacturing, where the yield is less than 99%,quality supervision of shortholding-time calls in order to identify poortransmission links, or bit errors in transmission for digital mobiletelephony (GSM).

In the case of GSM transmission, it has turned out that transmissionquality is lower than predicted since the effect of bursty behaviour hasbeen ignored.

Two solutions, referred to here as solution (1), or “BUCKET”, andsolution (2), or “CLOUD”, respectively, for determining the probabilityof a false result in a QOS measurement will now be described. As thesesolutions presuppose, as an example, use of the Leaky Bucket algorithmthe description will start with a brief analysis of the Leaky Bucketalgorithm.

Define a probability function u(d, b, h, F) where:

d=disturbance step, as described in U.S. Pat. No. 5,377,195, that is theamount by which a leaky bucket counter is incremented for eachdisturbance.

b=bias, also as in U.S. Pat. No. 5,377,195, that is the expected changeof a counter value after a base event. For example, if y=probability ofa disturbance, and x=1−y=probability of a normal event, then b=y*d−x.

h=height, or size of the bucket, measured in units of the disturbancestep. This measure is not used explicitly in U.S. Pat. No. 5,377,195,but is implicit in the reliability constant mentioned therein.

F=peakedness factor for the disturbance process.

u(d, b, h, F) is defined to be the probability of a false result in aQOS measurement. That is:

if b<0, u=P{bucket overflows}, that is false positive result, henceforthbeing referred to shortly as “false positive”.

if b>0, u=P{bucket underflows}, that is false negative result,henceforth being referred to shortly as “false negative”.

If b=0, then the value of u is of little interest, but is defined to be0.5 anyway.

Now u cannot be solved analytically. However, the two solutions (1),“BUCKET”, and (2), “CLOUD”, provide satisfactory “semi-analyticalsolutions”, that involve combination of mathematical analysis andarithmetic calculation in a computer program.

Solution (1), “BUCKET”:

If the disturbance process generates random, single disturbances, and ismonitored by a leaky bucket, then we can describe this situation as abounded, asymmetrical random walk. The mathematical tools for analysinga random walk are well-documented, for example, in “An Introduction toProbability Theory and its Applications”, Volume 1, Chapter 14, byWilliam Feller. Reference will be made below to this work by Feller.

Using Feller's own notation, the floor, or lower threshold for the leakybucket is set to zero, and the ceiling, or upper threshold, T is set tothe positive value, a. Further, the starting point of the counter is notnecessarily in the middle, but can be any value z between zero and ainclusive.

In general, P{k} is the probability of the counter moving upwards by ksteps. But in our random walk, P{k}=0 for all k except d and −1, where dis the disturbance step.

Feller's characteristic equation (8.5) gives:${\sum\limits_{k = {- \infty}}^{\infty}\quad {P\left\{ k \right\} s^{k}}} = {{{1\quad {which}\quad {simplifies}\quad {to}\text{:}\quad \frac{p}{s}} + {qs}^{d}} = 1}$

where p=P{−1}=probability of the counter stepping down by one, andq=P{d}=probability of the counter stepping up by d.

By convention, the probability of hitting the floor is known as theprobability of ruin, u(z), given starting point z.

Now this equation cannot be solved explicitly, but in the simple casewhere p=q*d (that is, bias b=0) we use Feller's equation (8.11):$\frac{\left( {a - z} \right)}{\left( {a + n - 1} \right)}<={u(z)}<=\frac{\left( {a + m - z - 1} \right)}{\left( {a + m - 1} \right)}$

m corresponds to Feller's Greek mu=d, and n corresponds to Feller'sGreek nu=−1.

This results in inequality (1):$\frac{\left( {a - z} \right)}{a}<={u(z)}<=\frac{\left( {a + d - z - 1} \right)}{\left( {a + d - 1} \right)}$

However, in the more general case p is not equal to q*d, that is, therandom walk is biased. Then we must solve the characteristic equation bymeans of a binary search. It should be observed that there are twodifferent cases, depending on whether p is greater or less than q*d. Ifp<q*d, bias b>0, and if p>q*d, bias b<0.)

Feller's equation (8.12) states:$\frac{\left( {s^{a} - s^{z}} \right)}{\left( {s^{a} - s^{({1 - n})}} \right)}<={u(z)}<=\frac{\left( {s^{({a + m - 1})} - s^{z}} \right)}{\left( {s^{({a + m - 1})} - 1} \right)}$

In our case, this becomes inequality (2):$\frac{\left( {s^{a} - s^{z}} \right)}{\left( {s^{a} - 1} \right)}<={u(z)}<=\frac{\left( {s^{({a + d - 1})} - s^{z}} \right)}{\left( {s^{({a + d - 1})} - 1} \right)}$

Thus we have upper and lower bounds for u(z).

The program, “BUCKET”, solves this inequality for u(z). It can be seenthat the upper and lower values of u(z) are close to each other, and theprogram just naively calculates the arithmetic mean of the two values.

When the bias is negative, then u(z) is close to one. As the probabilityof a false result is of more interest than the probability of ruin, thevalue of u(z) is replaced by 1−u(z) and prefixed with a minus sign.

The solution (1), “BUCKET”, is illustrated by the flow diagram of FIG.7a and a corresponding program written as follows in the language C++.

BUCKET #include <iostream.h> #include <math.h> //If the bias, b = 0, theprobability of hitting the floor, that is //the probability of ruin,u(z) is calculated by inequality (1) above. 5 //However, if the bias, bis not equal to zero, a binary search must //first be done. //Thissearch solves the equation p/s + q.s**d = 1. //This is the same assolving the equation: //f(s) = r + s**(d+1) − (r+1).s = 0, where r =p/q. 10 //Then u(z) is evaluated by inequality (2) above. //If the biasis negative, then it is more interesting to know //the probability ofhitting the ceiling, which is indicated with //a (meaningless) minussign. 15 //In this version of the program, d, b, and h are entered byhand, //and the starting point for the random walk is fixed to themiddle value. main( ) { 20 double d, r, a, b, h, z; double uz, uzl, uzr;// u(z) and its left and right values double s, sl, sr, sm; // s and itsleft, right and middle values double fsl, fsr, fsm; // left, right andmiddle values of f(s) 25 double sdl, sa, sz, sadl; //intermediatevariables for s to the power of . . . int i; //dummy variable floatdelta; cout << “\nEnter disturbance step, d : ”; 30 cin >> d; //Felleruses c, whereas this program uses d for the disturbance step cout <<“\nEnter bias, b : ”; cin >> b; 35 cout << “\nEnter height, h, ofceiling, in units of d : ”; cin >> h; r = (d−b)/(1+b); //r = p/q in therandom walk 40 a = h*d; //Feller uses a for the ceiling, or upperthreshold, T //Floor or lower threshold = 0 45 //random walk starts a= z= a/2; if (b==0) { //unbiased walk //uz are lower and upperprobabilities of hitting floor //that is probability of ruin (inequality(1)) 50 for (z=a/2; z<a; z=z+a) { //trivial loop uzl = (a−z)/a; uzr =(a+d−z−1)/(a+d−1); uz = (uzl+uzr)/2; 55 cout << “ ” << uz ; } } else {//biased walk 60 if (b<0) { //negative bias //binary search between 1and 2 sl = 1.000001; sr = 2; 65 s = sl; sdl = exp((d+1)*log(s)); fsl = r− sdl − (r+1)*s; s = sr; 70 sdl = exp((d+1)*log(s)); fsr = r + sdl −(r+1)*s; //that was the initial conditions //now start the search 75 for(i = 1; i <= 40; i++) { sm = (sl + sr)/2; s = sm; sdl =exp((d+1)*log(s)); 80 fsm = r + sdl − (r+1)*s; if (fsm < 0 ) { sl = sm;fsl = fsm; } 85 else { sr = sm; fsr = fsm; } delta = sr − sl; 90 if(delta < 0.000000001) { s = sm; goto solved; } } 95 } else { //positivebias //binary search between 0 and 1 sl = 0.000001; sr = 0.999999; 100 s= sl; sdl = exp((d+1)*log(s)); fsl = r + sdl − (r+1)*s; 105 s = sr; sdl= exp((d+1)*log(s)); fsr = r + sdl − (r+1)*s; //that was the initialconditions 110 //now start the search for (i = 1; i <= 40; i++) { sm =(sl + sr)/2; s = sm; 115 sdl = exp((d+1)*log(s)); fsm = r + sdl −(r+1)*s; if (fsm > 0 ) { sl = sm; fsl = fsm; 120 } else { sr = sm; fsr =fsm; } 125 delta = sr − sl; if (delta < 0.000000001) { s = sm; gotosolved; } 130 } } solved: //uz are lower and upper probabilities ofhitting floor 135 //that is probability of ruin (inequality (2)) for(z=a/2; z<a; z=z+a) { //trivial loop sa = exp(a*log(s)); sz =exp(z*log(s)); 140 sad1 = exp((a+d−l)*log(s)); uzl = (sa − sz)/(sa − 1);uzr = (sad1 − sz)/(sadl − 1); uz = (uzl+uzr)/2; 145 if (b<0) { uzl = uzl− 1; uzr = uzr − 1; uz = uz − 1; 150 } cout << “\nleft, mean, and rightvalues of u(z) :”; cout << “\n” << uzl << “ ” << uz << “ ” << uzr; } 155} cout << “\n\n” ; } 160

Referring now to FIG. 7a and the above program “BUCKET” the parametersdisturbance step d, bias b and height of bucket, h are set in step 702,lines 29-37 of the program BUCKET. The parameter h is in units of d.

Step 704 initializes the variables r=P{normal event}/P{disturbance}, andsize of bucket, a, as indicated in lines 39-45 of the program BUCKET.The variable a is in units of 1.

In step 706 it is decided whether the bias is or is not equal to zero,line 47 of the program BUCKET. If the bias b=0, being the uninterestingunbiased case, arrow 708, the probability of hitting the floor, that isthe probability of ruin, u(z) is calculated by inequality (1). Moreparticularly this is performed by calculating, in step 710, boundariesof probability u(a/2), using inequality (1), lines 48-53 of the programBUCKET, and outputting, in step 712, upper and lower bounds, andaverage, for probability of ruin, u(a/2), lines 54-55 of the programBUCKET.

If step 706 reveals that the bias is not equal to zero, a binary searchmust be done. This search solves the equation p/s+q.s**d=1. This is thesame as solving the equation: f(s)=r+s**(d+1)−(r+1)*s=0, where r=p/q.This is preceded by continuating, line 59 of the program BUCKET, to step714, for determining whether the bias is positive or negative, line 60of the program BUCKET.

If positive, arrow 716, line 96 of the program BUCKET, the equation issolved in the range 0<s<1, step 718, as indicated in lines 97-130 of theprogram BUCKET. If the bias is negative, arrow 720, then the equation issolved, step 722, in the range 1<s<2, lines 61-94 of the program BUCKET.

Then, both for positive bias and for negative bias, u(z) is evaluated byinequality (2). More particularly, this is performed by calculating, instep 724, boundaries of probability u(a/2) using inequality (2), lines134-143 of the program BUCKET, and outputting, in step 726, upper andlower bounds, and average, for probability of ruin, u(a/2), lines144-153 of the program BUCKET. Solution (2) “CLOUD”:

This is a supplement to the solution (1), done for the followingreasons:

to confirm the results of solution (1),

to investigate the effects of the peakedness.

The program CLOUD uses a two-state model of a type as described in U.S.Pat. No. 5,377,195, with the following state transition probabilitymatrix: $\begin{matrix}{{base}\quad {event}} & {{X\left( {n + 1} \right)} =} & \quad & 0 & 1 \\{{base}\quad {event}} & {{X(n)} =} & \begin{matrix}0 \\1\end{matrix} & \begin{matrix}\left\lbrack p \right. \\\left\lbrack Q \right.\end{matrix} & \begin{matrix}\left. q \right\rbrack \\\left. P \right\rbrack\end{matrix}\end{matrix}$

where:

P>q and Q<p;

p=P{X(n)=normal event, 0 & X(n+1)=normal event, 0},

q=P{X(n)=normal event, 0 & X(n+1)=disturbance, 1},

Q=P{X(n)=disturbance, 1 & X(n+1)=normal event, 0},

P=P{X(n)=disturbance, 1 & X(n+1)=disturbance, 1};

The steady-state probabilities for the two-state model are:

x=P{x(n)=0}=Q/(Q+q)

y=P{x(n)=1}=q/(Q+q)

Then, in the program CLOUD:

Let Y0(i,t)=P{state=0 and counter=i at time t}, and Y1(i,t)=P{state=1and counter=i at time t}.

Let Z0(i,t)=P{state=0 and counter=i at time t+1}, and Z1(i,t)=P{state=1and counter=i at time t+1}.

Then, in the middle of the bucket:

Z 0(i,t)=p*Y 0(i+1,t)+Q*Y 1(i+1,t) and

Z 1(i,t)=q*Y 0(i−d,t)+P*Y 1(i−d,t).

At the lower boundary zero, Y0(0,t)=P{lower threshold has been reachedby time t}. At the upper boundary C, Y1(C,t)=P{upper threshold has beenreached by time i}. Both Y0(0,t) and Y1(C,t) can be calculated bysumming probabilities in a correct way, to be described more in detailfurther on with reference to FIG. 7b.

Now, the upper and lower boundaries of the bucket can be regarded asprobability sinks. That is, as time t proceeds, more and moreprobability is absorbed by the sinks, and the weight w of theprobability remaining between the boundaries becomes less and less. Thisprobability between the boundaries is sometimes referred to asprobability remaining “in the cloud” between the boundaries. When theweight w is sufficiently small, we can say that we have calculated theprobabilities to a sufficient degree of accuracy.

The program “CLOUD”, calculates these probabilities, using a notationconsistent with the explanation above, and with the notation used todescribe the two-state model. Input to the program is the disturbancestep d, the bias b, the height h, and peakedness F>=1. Using this data,the start values for the bucket are calculated.

The explanation above should be sufficient to understand all the detailsin the program.

It should also be observed:

If F=1, the problem simplifies to the one-state model.

If F<1, the program does not work.

It is quite easy to generalize the program to any multi-state model fordisturbance processes.

The solution (2), “CLOUD”, is illustrated by the flow diagram of FIG. 7band the following corresponding program written in the language C++.

CLOUD #include <iostream.h> #include <math.h> 5 //The purpose of thisprogram is to calculate directly the probabili- //ties of a bucket beingin a particular state, at a particular time. //In this program thetwo-state model mentioned above is used. 10 //The program is used tostudy the relationship between the // peakedness and the height. main( ){ 15 int t=0; //time int i; //dummy variable int d; //disturbance stepdouble Y0 [1001]; //current state probabilities in state zero double Y1[1001]; //current state probabilities in state one 20 double Z0 [1001];//next state probabilities in state zero double Z1 [1001]; //next stateprobabilities in state one int C; //Ceiling int h; //height of ceiling,measured in disturbance steps double b; //bias 25 double F; //peakednessfactor (must be >= 1) double r; //determinant of the matrix in thetwo-state model double p, q, P, Q; //probabilities as in the two-statemodel double x, y; //steady-state probabilities double w=1; //weighsleft in cloud 30 double check; //dummy variable used for checking theweight double mean, mean2, variance, sd; // double pt; //probability ofhitting floor or ceiling at current t for (i=0 ; i<=1000; i++) { 35Y0[i] = 0; Y1[i] = 0; Z0[i] = 0; Z1[i] = 0; } 40 //Y and Z set to zeromean = 0; mean2 = 0; 45 cout << “\nEnter disturbance step d, bias b ,height h and peakedness F : ”; cin >> d >> b >> h >> F; C = h*d; r =(F−1)/(F+1); 50 q = (1−r)*(1+b)/(d+1); Q = (1−r)*(d−b)/(d+1); p = 1−q; P= 1−Q; x = Q/(Q+q); 55 y = q/(Q+q); Y0[C/2] = x; Y1[C/2] = y; cout <<“\nr : ” ; cout << r ; 60 cout << “\np, q : ”; cout << p <<“ ” << q ;cout << “\nQ, P : ”; 65 cout << Q << “ ” << P ; cout << “\nx, y : ”;cout << x << “ ” << y; 70 for (t=1 ; w >= 0.000001 ; t++) { Z0[0] =Y0[0] + p*Y0[1] + Q*Y1[1]; for (i=1 ; i<C−1; i++) { 75 Z0[i] =p*Y0[i+1] + Q*Y1[i+1] } Z0[C−1]=0; Z1[C] = Y1[C]; 80 for (i=C−1 ; i>=C−d; i−−) Z1[C] = Z1[C] + q*Y0[i] + P*Y1[i]; for (i=C−1; i>d ; i−−) 85Z1[i] = q*Y0]i−d] + P*Y1[i−d]; for (i=0; i<=C; i++) pt = Z1[C] − Y1[C] +Z0[0] − Y0[0]; 90 mean = mean + pt*(t+1); mean2 = mean2 +pt*(t+1)*(t+1); w = 1 − Z0[0] − Z1[C] ; 95 check = 0; for (i=1 ; i<C ;i++) check = check + Z0[i] + Z1[i]; for (i=1 ; i<=C ; i++) { 100 Y0[i] =Z0[i]; Y1[i] = Z1[i]; } Y0[0] = Z0[0]; Y1[C] = Z1[C]; 105 } cout <<“\nweight = :” << w <<“ ” << check; cout << “\nZ0[0] and Z1[C] : ”<<Z0[0] << “ ” << Z1[C] ; 110 variance = mean2 − mean*mean; sd =sqrt(variance); cout << “\n\nmean, standard deviation and current t : ”; cout << mean << “ ” << sd << “ ” << t ; 115 cout << “\n\n” ; }

Referring now to FIG. 7b and the above program “CLOUD”, step 730 entersthe parameters disturbance step d, bias b, peakedness F, height h ofbucket in units of d, lines 44-45 in the program CLOUD. Step 732initializes as variables the above mentioned matrix providingsteady-state probabilities for a base event being a normal event or adisturbance, as well as the probability distribution for time=0, lines33-42 and 47-67 in the program CLOUD.

Block 734 introduces start of a loop through t while weight>0.000001,line 70 in the program CLOUD. As mentioned above, by weight is meant theprobability of the counter remaining between the boundaries of thebucket. The loop includes the following steps.

Step 736: calculate P{state=0 & counter=i} at time=t+1, lines 71-76 inthe program CLOUD.

Step 738: calculate P{state=1 & counter=i} at time=t+1, lines 78-84 inthe program CLOUD.

Step 740: calculate P{counter hitting floor or ceiling} at time=t+1,lines 86-87 in the program CLOUD.

Step 742: calculate component of mean and mean square for duration ofmeasurement at time=t+1, lines 89-90 in the program CLOUD.

Step 744: calculate weight w of probability left in the cloud, line 92in the-program CLOUD.

Step 746: prepare for the next iteration of the loop by shifting values,lines 98-103 in the program CLOUD.

Block 748 indicates end of the loop, line 105 of the program CLOUD,after which the following further steps follow.

Step 750: calculate variance and standard deviation of duration for themeasurement, lines 110, 111 in the program CLOUD.

Step 752: produce probability of hitting floor and hitting ceiling, line108 in the program CLOUD.

Step 754: produce mean and standard deviation of duration, lines 112,113 in the program CLOUD.

In the table of FIG. 8, a selection of values of u are given forinteresting combinations of d, b, h and F. In most cases, that is wherepossible, results are given from both programs so that they can becompared. When solution (2) is used to calculate u, the mean time t forbucket to overflow or underflow is also given. The results have beenindexed in the left-hand column to make it easier to understand theconclusions.

Based upon an empirical study of the results from the solutions (1) and(2) the following conclusions have been drawn:

When both solutions can be used, that is, for small values of h and d,and for F=1, the separate solutions give consistent results. Thisconfirms that the reasoning for both solutions is correct. (All resultsexcept #5-#10)

Solution (1) gives values of u for all values of d, b, and h, providedF=1. (All results except #8-#10)

Solution (2) gives values of u, in principle for all values of d, b, h,and F. But the execution time becomes excessive when

d*h>=400. (All results except #5-#7, but #10 and #13 take a long time toexecute.)

Solution (2) gives values of t. In principle, t can be obtained by thesame method as in solution (1) as well. Feller recommends a method. (Allresults except #5-#7.)

Time t is proportional to d. (#1-#4, #14-#15, and #16-#17 etc.)

Time t increases linearly with h. (#1, #11, #12, #13)

Time t is proportional to F, when h increases with F. (#1, #8, #9, #10.)

For constant u, h is proportional to F. This is empirical verificationof a theoretically derived result in U.S. Pat. No. 5,377,195 (#1, #8,#9, #10.)

Probability u is independent of d. (#1-#7, #14-#15 etc.)

For fixed b and F, u can be approximated by A*(B**h), where A and B areconstants dependent on d and F. (#1, #11, #12, #13.)

There is an approximate symmetry in the dependence of u on b, that is:u(b)˜=u*(−b/(1+b)). (#1 and #14, #16 and #18, #20 and #22, #24 and #26,#28 and #29.)

The disturbance approximation does not appear to be necessary. Usefulresults can be obtained even for high disturbance frequencies. (#1-#5.)

These conclusions are approximate, but accurate enough for practicalpurposes. The errors in most cases are just a few percent.

As regards peakedness for randomly occurring bursts the followingconclusions have been drawn.

Suppose that Y is the sum of N independent, identically distributedrandom variables X(i), each with mean m, and variance V. Suppose alsothat N is itself a random variable, Poisson distributed and with mean 1.

Then, it can be proved that the mean of Y=1 *m, and that the variance ofY=1 *(V+m**2). Further, the peakedness of Y=variance/mean=m+V/m.

Now, if each X represents the number of disturbances in a disturbanceburst, and Y represents the number of disturbances generated by adisturbance process during a long time interval, then the peakedness forY is easily calculated from the mean and variance for the individualbursts, that is, m+V/m.

This simple formula can be applied to all multi-state models fordisturbance processes in order to calculate the peakedness. For example,when applied to the two-state model, we get confirmation of the valuefor the peakedness.

What is claimed is:
 1. A method for performing, in a computer-controlledprocess, an algorithm-controlled monitoring of disturbances which mayoccur at random or in bursts in the process, said monitoring usingcounting values obtained from a counter for counting said disturbances,said method comprising: i) defining an abnormal event regarded to be adisturbance, ii) defining a base against which disturbances are to becounted, comprising determining whether the base should be a unit oftime, a base event, or an artificial base, the outcome being a randomvariable able to take a value indicating normal event or disturbance,iii) defining a unit to be used as a measure of a disturbance frequency,iv) determining values of the disturbance frequency in circumstancesthat can be expected in operation of a process generating thedisturbance to be monitored, said values including a critical value fCof the disturbance frequency where the monitoring nominally issues analarm, v) determining for the process, at said critical value, apeakedness factor F, being a measure of how bursty the disturbances are,as the ratio of the variance to the mean of occurrences of disturbancesin the process, vi) choosing for the algorithm an inertia value J beinga measure of how fast or slowly the algorithm is desired to react tochanges in the disturbance frequency, so as to achieve an acceptablecompromise between speed and reliability of the monitoring, vii)calculating parameters for the monitoring based upon the disturbancefrequency value fC, the peakedness factor F and the inertia value J, andusing said parameters to calculate according to 1/fC*J*F a thresholdvalue T of the counter considered to be unacceptable, iix) designing thealgorithm for the monitoring with said parameters, ix) initiating themonitoring and waiting for results thereof, x) evaluating the resultsand, if necessary, adjusting the parameters.
 2. A method according toclaim 1, comprising using as a condition that the disturbance frequencymeasured against all base events is not different by more than apredetermined amount from the frequency measured just against normalevents.
 3. A method according to claim 2, wherein the evaluating stepincludes a step of determining the probability of obtaining a falseresult in the monitoring, based upon using a Leaky Bucket algorithm inwhich said probability is defined as u(d,b,h,F), wherein d=disturbancestep is the amount by which a leaky bucket counter is incremented foreach disturbance, b=bias is the expected change of a counter value aftera base event, b<0 implying a false positive result obtained when alarmis given, and b>0 implying a false negative result obtained when noalarm is given, h=size of the bucket, measured in units of thedisturbance step, F=peakedness factor for the disturbance process.
 4. Amethod according to claim 2, using the Leaky Bucky algorithm, whereinthe value for the inertia is used as a multiplier on the size of theleaky bucket.
 5. A method according to claim 2, wherein the step ofevaluating the results comprises a first substep of investigatingwhether measurements can be regarded as reliable, and, if yes, ending bytaking no further action, a second substep that, if the first substepreveals that measurements are not reliable, comprises investigatingthree possible sources of error, namely whether 1) there are more than apredetermined number of false alarms, 2) faulty equipment stays inservice, or 3) the time to get results is more than a predeterminedperiod of time, and on a third substep level, performing either of thefollowing three steps, (i) if there are more than a predetermined numberof false alarms, increasing the value of fC, or increasing the value ofJ or F, by recalculating d and T and returning to first substep, (ii) iffaulty equipment stays in service without raising an alarm, reducing fC,or reducing J or F, recalculating d and T and returning to the firstsubstep, (iii) if the time to get results is more than a predeterminedperiod of time, reducing the value of J or F, recalculating d and T andreturning to the first substep.
 6. A method according to claim 2,including the step of producing a risk table including a number ofcolumns, of which four columns contain, in turn, level of disturbancefrequency, bias, being expected change of a counter value after a baseevent, value of the disturbance frequency, and risk of false result,respectively, by selecting a suitable set of values of the bias,calculating values of the disturbance frequency by adjusting thecritical frequency with the respective values of the bias, and settingvalues for risks based upon measurements, economic analysis, experience,judgement or intuition.
 7. A method according to claim 2, comprisingdetermining, besides the value of the critical frequency, the values ofone or more of the following further levels of the disturbancefrequency: fN=normal frequency in operation; fR=raised frequency inoperation, but one that is still acceptable, fE=excessive frequency, atwhich the working of the equipment is degraded, fU=unacceptablefrequency, where there are too many disturbances for normal operation.8. A method according to claim 2, wherein the bursty behavior isconsidered solely on the basis of the peakedness factor, together withthe disturbance frequency.
 9. A method according to claim 1, comprisingdetermining, besides the value of the critical frequency, the values ofone or more of the following further levels of the disturbancefrequency: fN=normal frequency in operation, fR=raised frequency inoperation, but one that is still acceptable, fE=excessive frequency, atwhich the working of the equipment is degraded, fU=unacceptablefrequency, where there are too many disturbances for normal operation.10. A method according to claim 9, wherein the step of evaluating theresults comprises a first substep of investigating whether measurementscan be regarded as reliable, and, if yes, ending by taking no furtheraction, a second substep that, if the first substep reveals thatmeasurements are not reliable, comprises investigating three possiblesources of error, namely whether 1) there are more than a predeterminednumber of false alarms, 2) faulty equipment stays in service, or 3) thetime to get results is more than a predetermined period of time, and ona third substep level, performing either of the following three steps,(i) if there are more than a predetermined number of false alarms,increasing the value of fC, or increasing the value of J or F, byrecalculating d and T and returning to first substep, (ii) if faultyequipment stays in service without raising an alarm, reducing fC, orreducing J or F, recalculating d and T and returning to the firstsubstep, (iii) if the time to get results is more than a predeterminedperiod of time, reducing the value of J or F, recalculating d and T andreturning to the first substep.
 11. A method according to claim 9, usingthe Leaky Bucky algorithm, wherein the value for the inertia is used asa multiplier on the size of the leaky bucket.
 12. A method according toclaim 9, including the step of producing a risk table including a numberof columns, of which four columns contain, in turn, level of disturbancefrequency, bias, being expected change of a counter value after a baseevent, value of the disturbance frequency, and risk of false result,respectively, by selecting a suitable set of values of the bias,calculating values of the disturbance frequency by adjusting thecritical frequency with the respective values of the bias, and settingvalues for risks based upon measurements, economic analysis, experience,judgement or intuition.
 13. A method according to claim 9, wherein theevaluating step includes a step of determining the probability ofobtaining a false result in the monitoring, based upon using a LeakyBucket algorithm in which said probability is defined as u(d,b,h,F),wherein d=disturbance step is the amount by which a leaky bucket counteris incremented for each disturbance, b=bias is the expected change of acounter value after a base event, b<0 implying a false positive resultobtained when alarm is given, and b>0 implying a false negative resultobtained when no alarm is given, h=size of the bucket, measured in unitsof the disturbance step, F=peakedness factor for the disturbanceprocess.
 14. A method according to claim 9, wherein the bursty behavioris considered solely on the basis of the peakedness factor, togetherwith the disturbance frequency.
 15. A method according to claim 1,wherein the bursty behaviour is considered solely on the basis of thepeakedness factor, together with the disturbance frequency.
 16. A methodaccording to claim 15, wherein the step of evaluating the resultscomprises a first substep of investigating whether measurements can beregarded as reliable, and, if yes, ending by taking no further action, asecond substep that, if the first substep reveals that measurements arenot reliable, comprises investigating three possible sources of error,namely whether 1) there are more than a predetermined number of falsealarms, 2) faulty equipment stays in service, or 3) the time to getresults is more than a predetermined period of time, and on a thirdsubstep level, performing either of the following three steps, (i) ifthere are more than a predetermined number of false alarms, increasingthe value of fC, or increasing the value of J or F, by recalculating dand T and returning to first substep, (ii) if faulty equipment stays inservice without raising an alarm, reducing fC, or reducing J or F,recalculating d and T and returning to the first substep, (iii) if thetime to get results is more than a predetermined period of time,reducing the value of J or F, recalculating d and T and returning to thefirst substep.
 17. A method according to claim 15, using the Leaky Buckyalgorithm, wherein the value for the inertia is used as a multiplier onthe size of the leaky bucket.
 18. A method according to claim 15,wherein the evaluating step includes a step of determining theprobability of obtaining a false result in the monitoring, based uponusing a Leaky Bucket algorithm in which said probability is defined asu(d,b,h,F), wherein d=disturbance step is the amount by which a leakybucket counter is incremented for each disturbance, b=bias is theexpected change of a counter value after a base event, b<0 implying afalse positive result obtained when alarm is given, and b>0 implying afalse negative result obtained when no alarm is given, h=size of thebucket, measured in units of the disturbance step, F=peakedness factorfor the disturbance process.
 19. A method according to claim 15,including the step of producing a risk table including a number ofcolumns, of which four columns contain, in turn, level of disturbancefrequency, bias, being expected change of a counter value after a baseevent, value of the disturbance frequency, and risk of false result,respectively, by selecting a suitable set of values of the bias,calculating values of the disturbance frequency by adjusting thecritical frequency with the respective values of the bias, and settingvalues for risks based upon measurements, economic analysis, experience,judgement or intuition.
 20. A method according to claim 1, using theLeaky Bucket algorithm, wherein the value for the inertia is used as amultiplier on the size of the leaky bucket.
 21. A method according toclaim 20, including the step of producing a risk table including anumber of columns, of which four columns contain, in turn, level ofdisturbance frequency, bias, being expected change of a counter valueafter a base event, value of the disturbance frequency, and risk offalse result, respectively, by selecting a suitable set of values of thebias, calculating values of the disturbance frequency by adjusting thecritical frequency with the respective values of the bias, and settingvalues for risks based upon measurements, economic analysis, experience,judgement or intuition.
 22. A method according to claim 20, wherein thestep of evaluating the results comprises a first substep ofinvestigating whether measurements can be regarded as reliable, and, ifyes, ending by taking no further action, a second substep that, if thefirst substep reveals that measurements are not reliable, comprisesinvestigating three possible sources of error, namely whether 1) thereare more than a predetermined number of false alarms, 2) faultyequipment stays in service, or 3) the time to get results is more than apredetermined period of time, and on a third substep level, performingeither of the following three steps, (i) if there are more than apredetermined number of false alarms, increasing the value of fC, orincreasing the value of J or F, by recalculating d and T and returningto first substep, (ii) if faulty equipment stays in service withoutraising an alarm, reducing fC, or reducing J or F, recalculating d and Tand returning to the first substep, (iii) if the time to get results ismore than a predetermined period of time, reducing the value of J or F,recalculating d and T and returning to the first substep.
 23. A methodaccording to claim 20, wherein the evaluating step includes a step ofdetermining the probability of obtaining a false result in themonitoring, based upon using a Leaky Bucket algorithm in which saidprobability is defined as u(d,b,h,F), wherein d=disturbance step is theamount by which a leaky bucket counter is incremented for eachdisturbance, b=bias is the expected change of a counter value after abase event, b<0 implying a false positive result obtained when alarm isgiven, and b>0 implying a false negative result obtained when no alarmis given, h=size of the bucket, measured in units of the disturbancestep, F=peakedness factor for the disturbance process.
 24. A methodaccording to claim 1, including the step of producing a risk tableincluding a number of columns, of which four columns contain, in turn,level of disturbance frequency, bias, being expected change of a countervalue after a base event, value of the disturbance frequency, and riskof false result, respectively, by selecting a suitable set of values ofthe bias, calculating values of the disturbance frequency by adjustingthe critical frequency with the respective values of the bias, andsetting values for risks based upon measurements, economic analysis,experience, judgement or intuition.
 25. A method according to claim 24,wherein the evaluating step includes a step of determining theprobability of obtaining a false result in the monitoring, based uponusing a Leaky Bucket algorithm in which said probability is defined asu(d,b,h,F), wherein d=disturbance step is the amount by which a leakybucket counter is incremented for each disturbance, b=bias is theexpected change of a counter value after a base event, b<0 implying afalse positive result obtained when alarm is given, and b>0 implying afalse negative result obtained when no alarm is given, h=size of thebucket, measured in units of the disturbance step, F=peakedness factorfor the disturbance process.
 26. A method according to claim 24, whereinthe step of evaluating the results comprises a first substep ofinvestigating whether measurements can be regarded as reliable, and, ifyes, ending by taking no further action, a second substep that, if thefirst substep reveals that measurements are not reliable, comprisesinvestigating three possible sources of error, namely whether 1) thereare more than a predetermined number of false alarms, 2) faultyequipment stays in service, or 3) the time to get results is more than apredetermined period of time, and on a third substep level, performingeither of the following three steps, (i) if there are more than apredetermined number of false alarms, increasing the value of fC, orincreasing the value of J or F, by recalculating d and T and returningto first substep, (ii) if faulty equipment stays in service withoutraising an alarm, reducing fC, or reducing J or F, recalculating d and Tand returning to the first substep, (iii) if the time to get results ismore than a predetermined period of time, reducing the value of J or F,recalculating d and T and returning to the first substep.
 27. A methodaccording to claim 1, wherein the step of evaluating the resultscomprises a first substep of investigating whether measurements can beregarded as reliable, and, if yes, ending by taking no further action, asecond substep that, if the first substep reveals that measurements arenot reliable, comprises investigating three possible sources of error,namely whether 1) there are too many false alarms, 2) faulty equipmentstays in service, or 3) the time to get results is more than apredetermined period of time, and on a third substep level, performingeither of the following three steps, (i) if there are more than acertain number of false alarms, increasing the value of fC, orincreasing the value of J or F, by recalculating d and T and returningto first substep, (ii) if faulty equipment stays in service withoutraising an alarm, reducing fC, or reducing J or F, recalculating d and Tand returning to the first substep, (iii) if the time to get results ismore than a certain period of time, reducing the value of J or F,recalculating d and T and returning to the first substep.
 28. A methodaccording to claim 27, wherein the evaluating step includes a step ofdetermining the probability of obtaining a false result in themonitoring, based upon using a Leaky Bucket algorithm in which saidprobability is defined as u(d,b,h,F), wherein d=disturbance step is theamount by which a leaky bucket counter is incremented for eachdisturbance, b=bias is the expected change of a counter value after abase event, b<0 implying a false positive result obtained when alarm isgiven, and b>0 implying a false negative result obtained when no alarmis given, h=size of the bucket, measured in units of the disturbancestep, F=peakedness factor for the disturbance process.
 29. A methodaccording to claim 1, wherein the evaluating step includes a step ofdetermining the probability of obtaining a false result in themonitoring, based upon using a Leaky Bucket algorithm in which saidprobability is defined as u(d,b,h,F), wherein d=disturbance step is theamount by which a leaky bucket counter is incremented for eachdisturbance, b=bias is the expected change of a counter value after abase event, b<0 implying a false positive result obtained when alarm isgiven, even though there is nothing wrong with a supervised object, andb>0 implying a false negative result obtained when no alarm is given,even though there is something wrong with the supervised object, h=sizeof the bucket, measured in units of the disturbance step, F=peakednessfactor for the disturbance process.
 30. A method according to claim 29,wherein the step of determining the probability of obtaining a falseresult includes the substeps of entering as parameters: disturbance stepd, bias b and size h of bucket, initializing as variables: r=P{normalevent}/P{disturbance}, wherein P{normal event} means probability of anormal event appearing and P{disturbance} means probability of adisturbance appearing, a=h*d being size of the bucket in units of 1,determining whether bias b=0, <0 or >0, calculating, if bias=0,boundaries of probability u(a/2), while using inequality$\frac{\left( {a - z} \right)}{a}<={u(z)}<=\frac{\left( {a + d - z - 1} \right)}{\left( {a + d - 1} \right)}$

wherein u(z) means probability of hitting the floor of the bucket, givenstarting point z, producing upper and lower bounds, and average for theprobability u(a/2), solving with binary search, if bias is not =0, theequation f(s)=r+s**(d+1)−(r+1)*s=0, in either the range 1<s<2 for b<0,or in the range 0<s<1 for b>0, wherein s is a dummy variable,calculating boundaries of probability u(a/2) using inequality$\frac{\left( {{s**a} - {s**z}} \right)}{\left( {{s**a} - 1} \right)}<={u(z)}<=\frac{\left( {{s**\left( {a + d - 1} \right)} - {s**z}} \right)}{\left( {{s**\left( {a + d - 1} \right)} - 1} \right)}$

producing upper and lower bounds, and average, for probability u(a/2).31. A method according to claim 30, wherein the step of determining theprobability of obtaining a false result includes the substeps ofentering as parameters: disturbance step d, bias b, peakedness F andsize h of bucket, initializing as variables: a state transitionprobability matrix: base event X(n+1) = 01 base event X(n) = 0

 where: P>q and Q<p; p=P{X(n)=normal event, 0 & X(n+1)=normal event, 0},q=P{X(n)=normal event, 0 & X(n+1)=disturbance, 1}, Q=P{X(n)=disturbance,1 & X(n+1)=normal event, 0}, P=P{X(n)=disturbance, 1 &X(n+1)=disturbance, 1}; the steady-state probabilities for the two-statemodel are:  x=P{x(n)=0}=Q/(Q+q)  y=P{x(n)=1}=q/(Q+q)  probabilitydistribution for time=0,  performing in a loop through time t whileweight=>0.000001, weight being the probability of the counter remainingbetween the boundaries of the bucket, the substeps of  calculatingprobability P{state=0 & counter=i} at time=t+1,  calculating probabilityP{state=1 & counter=i} at time=t+1,  calculating probability P{counterhitting floor or ceiling} at time=t+1,  calculating component of meanand mean square for duration of measurement at time=t+1,  calculatingweight,  preparing for the next iteration of the loop by shiftingvalues, and ending loop,  calculating variance and standard deviation ofduration for the measurement,  producing probability of hitting floorand hitting ceiling,  producing mean and standard deviation of duration.32. A method according to claim 1, wherein the step of determining theprobability of obtaining a false result includes the substeps ofentering as parameters: disturbance step d, bias b, peakedness F andsize h of bucket, initializing as variables: a state transitionprobability matrix: base event X(n+1)=01 $\begin{matrix}\quad & 0 & \quad \\{{base}\quad {event}} & {{X(n)} =} & \quad \\\quad & \quad & 1\end{matrix}$

 where:  P>q and Q<p;  p=P{X(n)=normal event, 0 & X(n+1)=normal event,0},  q=P{X(n)=normal event, 0 & X(n+1)=disturbance, 1}, Q=P{X(n)=disturbance, 1 & X(n+1)=normal event, 0}, P=P{X(n)=disturbance, 1 & X(n+1)=disturbance, 1};  the steady-stateprobabilities for the two-state model are:  x=P{x(n)=O}=Q/(Q+q) y=P{x(n)=1 }=q/(Q+q)  probability distribution for time=0,  performingin a loop through time t while weight=>0.000001, weight being theprobability of the counter remaining between the boundaries of thebucket, the substeps of  calculating probability P{state=0 & counter=i}at time=t+1,  calculating probability P{state=1 & counter=i} attime=t+1,  calculating probability P{counter hitting floor or ceiling}at time=t+1,  calculating component of mean and mean square for durationof measurement at time=t+1,  calculating weight,  preparing for the nextiteration of the loop by shifting values, and ending loop,  calculatingvariance and standard deviation of duration for the measurement, producing probability of hitting floor and hitting ceiling,  producingmean and standard deviation of duration.
 33. A method for performing, ina computer-controlled process, an algorithm-controlled monitoring ofdisturbances which may occur at random or in bursts in the process, saidmonitoring using counting values obtained from a counter for countingsaid disturbances, said method comprising: i) defining an abnormal eventregarded to be a disturbance, ii) defining a base against whichdisturbances are to be counted, iii) defining a unit to be used as ameasure of a disturbance frequency, iv) determining values of thedisturbance frequency in circumstances that can be expected in operationof a process generating the disturbance to be monitored, said valuesincluding a critical value fC of the disturbance frequency where themonitoring nominally issues an alarm, v) determining for the process, atsaid critical value, a peakedness factor F, being a measure of howbursty the disturbances are, as the ratio of the variance to the mean ofoccurrences of disturbances in the process, wherein the bursty behaviouris considered solely on the basis of the peakedness factor, togetherwith the disturbance frequency, vi) choosing for the algorithm aninertia value J being a measure of how fast or slowly the algorithm isdesired to react to changes in the disturbance frequency, so as toachieve an acceptable compromise between speed and reliability of themonitoring, vii) calculating parameters for the monitoring based uponthe disturbance frequency value fC, the peakedness factor F and theinertia value J, and using said parameters to calculate according to1/fC*J*F a threshold value T of the counter considered to beunacceptable, iix) designing the algorithm for the monitoring with saidparameters, ix) initiating the monitoring and waiting for resultsthereof, x) evaluating the results and, if necessary, adjusting theparameters.
 34. A method according to claim 33, wherein the step ii) ofdefining a base comprises determining whether the base should be a unitof time, a base event, or an artificial base, the outcome being a randomvariable able to take a value indicating normal event or disturbance.35. A method according to claim 34, wherein the bursty behavior isconsidered solely on the basis of the peakedness factor, together withthe disturbance frequency.
 36. A method according to claim 34,comprising using as a condition that the disturbance frequency measuredagainst all base events is not different by more than a predeterminedamount from the frequency measured just against normal events.
 37. Amethod according to claim 34, wherein the step of evaluating the resultscomprises a first substep of investigating whether measurements can beregarded as reliable, and, if yes, ending by taking no further action, asecond substep that, if the first substep reveals that measurements arenot reliable, comprises investigating three possible sources of error,namely whether 1) there are more than a predetermined number of falsealarms, 2) faulty equipment stays in service, or 3) the time to getresults is more than a predetermined period of time, and on a thirdsubstep level, performing either of the following three steps, (i) ifthere are more than a predetermined number of false alarms, increasingthe value of fC, or increasing the value of J or F, by recalculating dand T and returning to first substep, (ii) if faulty equipment stays inservice without raising an alarm, reducing fC, or reducing J or F,recalculating d and T and returning to the first substep, (iii) if thetime to get results is more than a predetermined period of time,reducing the value of J or F, recalculating d and T and returning to thefirst substep.
 38. A method according to claim 34, wherein theevaluating step includes a step of determining the probability ofobtaining a false result in the monitoring, based upon using a LeakyBucket algorithm in which said probability is defined as u(d,b,h,F),wherein d=disturbance step is the amount by which a leaky bucket counteris incremented for each disturbance, b=bias is the expected change of acounter value after a base event, b<0 implying a false positive resultobtained when alarm is given, and b>0 implying a false negative resultobtained when no alarm is given, h=size of the bucket, measured in unitsof the disturbance step, F=peakedness factor for the disturbanceprocess.
 39. A method according to claim 34, comprising determining,besides the value of the critical frequency, the values of one or moreof the following further levels of the disturbance frequency: fN=normalfrequency in operation; fR=raised frequency in operation, but one thatis still acceptable, fF=excessive frequency, at which the working of theequipment is degraded, fU=unacceptable frequency, where there are toomany disturbances for normal operation.
 40. A method according to claim34, using the Leaky Bucky algorithm, wherein the value for the inertiais used as a multiplier on the size of the leaky bucket.
 41. A methodaccording to claim 34, including the step of producing a risk tableincluding a number of columns, of which four columns contain, in turn,level of disturbance frequency, bias, being expected change of a countervalue after a base event, value of the disturbance frequency, and riskof false result, respectively, by selecting a suitable set of values ofthe bias, calculating values of the disturbance frequency by adjustingthe critical frequency with the respective values of the bias, andsetting values for risks based upon measurements, economic analysis,experience, judgement or intuition.
 42. A method according to claim 33,including the step of producing a risk table including a number ofcolumns, of which four columns contain, in turn, level of disturbancefrequency, bias, being expected change of a counter value after a baseevent, value of the disturbance frequency, and risk of false result,respectively, by selecting a suitable set of values of the bias,calculating values of the disturbance frequency by adjusting thecritical frequency with the respective values of the bias, and settingvalues for risks based upon measurements, economic analysis, experience,judgement or intuition.
 43. A method according to claim 33, wherein theevaluating step includes a step of determining the probability ofobtaining a false result in the monitoring, based upon using a LeakyBucket algorithm in which said probability is defined as u(d,b,h,F),wherein d=disturbance step is the amount by which a leaky bucket counteris incremented for each disturbance, b=bias is the expected change of acounter value after a base event, b<0 implying a false positive resultobtained when alarm is given, and b>0 implying a false negative resultobtained when no alarm is given, h=size of the bucket, measured in unitsof the disturbance step, F=peakedness factor for the disturbanceprocess.
 44. A method according to claim 33, wherein the step ofevaluating the results comprises a first substep of investigatingwhether measurements can be regarded as reliable, and, if yes, ending bytaking no further action, a second substep that, if the first substepreveals that measurements are not reliable, comprises investigatingthree possible sources of error, namely whether 1) there are more than apredetermined number of false alarms, 2) faulty equipment stays inservice, or 3) the time to get results is more than a predeterminedperiod of time, and on a third substep level, performing either of thefollowing three steps, (i) if there are more than a predetermined numberof false alarms, increasing the value of fC, or increasing the value ofJ or F, by recalculating d and T and returning to first substep, (ii) iffaulty equipment stays in service without raising an alarm, reducing fC,or reducing J or F, recalculating d and T and returning to the firstsubstep, (iii) if the time to get results is more than a predeterminedperiod of time, reducing the value of J or F, recalculating d and T andreturning to the first substep.
 45. A method according to claim 33,comprising determining, besides the value of z the critical frequency,the values of one or more of the following further levels of thedisturbance frequency: fN=normal frequency in operation; fR=raisedfrequency in operation, but one that is still acceptable, fE=excessivefrequency, at which the working of the equipment is degraded,fU=unacceptable frequency, where there are too many disturbances fornormal operation.
 46. A method according to claim 33, using the LeakyBucket algorithm, wherein the value for the inertia is used as amultiplier on the size of the leaky bucket.
 47. A method for performing,in a computer-controlled process, an algorithm-controlled monitoring ofdisturbances which may occur at random or in bursts in the process, saidmonitoring using counting values obtained from a counter for countingsaid disturbances, said method comprising: i) defining an abnormal eventregarded to be a disturbance, ii) defining a base against whichdisturbances are to be counted, comprising determining whether the baseshould be a unit of time, a base event, or an artificial base, theoutcome being a random variable able to take a value indicating normalevent or disturbance, iii) defining a unit to be used as a measure of adisturbance frequency, iv) determining values of the disturbancefrequency in circumstances that can be expected in operation of aprocess generating the disturbance to be monitored, said valuesincluding a critical value fC of the disturbance frequency where themonitoring nominally issues an alarm, v) determining for the process, atsaid critical value, a peakedness factor F, being a measure of howbursty the disturbances are, as the ratio of the variance to the mean ofoccurrences of disturbances in the process, vi) choosing for thealgorithm an inertia value J being a measure of how fast or slowly thealgorithm is desired to react to changes in the disturbance frequency,so as to achieve an acceptable compromise between speed and reliabilityof the monitoring, vii) calculating parameters for the monitoring basedupon the disturbance frequency value fC, the peakedness factor F and theinertia value J, and using said parameters to calculate according to1/fC*J*F a threshold value T of the counter considered to beunacceptable, iix) designing the algorithm for the monitoring with saidparameters, ix) initiating the monitoring and waiting for resultsthereof, x) evaluating the results and, if necessary, adjusting theparameters, comprising a first substep of investigating whethermeasurements can be regarded as reliable, and, if yes, ending by takingno further action, a second substep that, if the first substep revealsthat measurements are not reliable, comprises investigating threepossible sources of error, namely whether 1) there are more than apredetermined number of false alarms, 2) faulty equipment stays inservice, or 3) the time to get results is more than a predeterminedperiod of time, and on a third substep level, performing either of thefollowing three steps, (i) if there are more than a predetermined numberof false alarms, increasing the value of fC, or increasing the value ofJ or F, by recalculating d and T and returning to first substep, (ii) iffaulty equipment stays in service without raising an alarm, reducing fC,or reducing J or F, recalculating d and T and returning to the firstsubstep, (iii) if the time to get results is too long, reducing thevalue of J or F, recalculating d and T and returning to the firstsubstep.
 48. A method according to claim 47, comprising determining,besides the value of the critical frequency, the values of one or moreof the following further levels of the disturbance frequency: fN=normalfrequency in operation; fR=raised frequency in operation, but one thatis still acceptable, fE=excessive frequency, at which the working of theequipment is degraded, fU=unacceptable frequency, where there are toomany disturbances for normal operation.
 49. A method according to claim47, wherein the evaluating step includes a step of determining theprobability of obtaining a false result in the monitoring, based uponusing a Leaky Bucket algorithm in which said probability is defined asu(d,b,h,F), wherein d=disturbance step is the amount by which a leakybucket counter is incremented for each disturbance, b=bias is theexpected change of a counter value after a base event, b<0 implying afalse positive result obtained when alarm is given, and b>0 implying afalse negative result obtained when no alarm is given, h=size of thebucket, measured in units of the disturbance step, F=peakedness factorfor the disturbance process.
 50. A method according to claim 47, whereinthe step ii) of defining a base comprises determining whether the baseshould be a unit of time, a base event, or an artificial base, theoutcome being a random variable able to take a value indicating normalevent or disturbance.
 51. A method according to claim 47, wherein thebursty behavior is considered solely on the basis of the peakednessfactor, together with the disturbance frequency.
 52. A method accordingto claim 47, using the Leaky Bucky algorithm, wherein the value for theinertia is used as a multiplier on the size of the leaky bucket.
 53. Amethod according to claim 47, including the step of producing a risktable including a number of columns, of which four columns contain, inturn, level of disturbance frequency, bias, being expected change of acounter value after a base event, value of the disturbance frequency,and risk of false result, respectively, by selecting a suitable set ofvalues of the bias, calculating values of the disturbance frequency byadjusting the critical frequency with the respective values of the bias,and setting values for risks based upon measurements, economic analysis,experience, judgement or intuition.
 54. A method comprising determiningthe probability of false results in an algorithm-controlled monitoringof disturbances performed in a computer-controlled process, wherein thedisturbances may occur at random or in bursts in the process, saidmonitoring using counting values obtained from a counter for countingsaid disturbances, said monitoring comprising the steps of defining anabnormal event regarded to be a disturbance, defining a base againstwhich disturbances are to be counted, and defining a unit to be used asa measure of a disturbance frequency, the method further comprising:determining the probability based upon using a Leaky Bucket algorithm inwhich said probability is defined as u(d,b,h,F), wherein d=disturbancestep is the amount by which a leaky bucket counter is incremented foreach disturbance, b=bias is the expected change of a counter value aftera base event, b<0 implying a false positive result obtained when alarmis given, even though there is nothing wrong with a supervised object,and b>0 implying a false negative result obtained when no alarm isgiven, even though there is something wrong with the supervised object,h=size of the bucket, measured in units of the disturbance step,F=peakedness factor for the disturbance process, being a measure of howbursty the disturbances are, entering d, b and h as parametersinitializing as variables:  r=P{normal event}/P{disturbance}, whereinP{normal event} means probability of a normal event appearing and P{disturbance} means probability of a disturbance appearing,  a=h*d beingsize of the bucket in units of 1,  there is determined whether bias b=0,<0 or >0.  calculating, if bias=0, boundaries of probability u(a/2),while using inequality$\frac{\left( {a - z} \right)}{a}<={u(z)}<=\frac{\left( {a + d - z - 1} \right)}{\left( {a + d - 1} \right)}$

 wherein u(z) means probability of hitting the floor of the bucket,given starting point z,  producing upper and lower bounds, and averagefor the probability u(a/2),  solving with binary search, if bias isnot=0, the equation f(s)=r+s**(d+1)−(r+1)*s=0, in either the range 1<s<2for b<0, or in the range 0 <s <1 for b>0, wherein s is a dummy variable,calculating  boundaries  of  probability  u(a/2)  using  inequality$\frac{\left( {{s**a} - {s**z}} \right)}{\left( {{s**a} - 1} \right)}<={u(z)}<=\frac{\left( {{s**\left( {a + d - 1} \right)} - {s**z}} \right)}{\left( {{s**\left( {a + d - 1} \right)} - 1} \right)}$

 producing upper and lower bounds, and average, for probability u(a/2).55. A method for determining the probability of false results in analgorithm-controlled monitoring of disturbances performed in acomputer-controlled process, wherein the disturbances are apt to occurat random or in bursts in the process, said monitoring using countingvalues obtained from a counter for counting said disturbances, saidmonitoring comprising the steps of defining an abnormal event regardedto be a disturbance, defining a base against which disturbances are tobe counted, and defining a unit to be used as a measure of a disturbancefrequency, the method comprising: determining the probability based uponusing a Leaky Bucket algorithm in which said probability is defined asu(d,b,h,F), wherein d=disturbance step is the amount by which a leakybucket counter is incremented for each disturbance, b=bias is theexpected change of a counter value after a base event, b<0 implying afalse positive result obtained when alarm is given, even though there isnothing wrong with a supervised object, and b>0 implying a falsenegative result obtained when no alarm is given, even though there issomething wrong with the supervised object, h=size of the bucket,measured in units of the disturbance step, F=peakedness factor for thedisturbance process, being a measure of how bursty the disturbances are,entering d, b and h as parameters initializing as variables:  a statetransition probability matrix: base  event  X(n + 1) = 0  1${{base}\quad {event}\quad {\underset{1}{X}(n)}} = \begin{matrix}0 \\\quad\end{matrix}$

 where:  P>q and Q<p;  p=P{X(n)=normal event, 0 & X(n+1)=normal event,0},  q=P{X(n)=normal event, 0 & X(n+1)=disturbance, 1}, Q=P{X(n)=disturbance, 1 & X(n+1)=normal event, 0}, P=P{X(n)=disturbance, 1 & X(n+1)=disturbance, 1};  the steady-stateprobabilities for the two-state model are:  x=P{x(n)=0}=Q/(Q+q) y=P{x(n)=1}=q/(Q+q)  probability distribution for time=0,  performingin a loop through time t while weight=>0.000001, weight being theprobability of the counter remaining between the boundaries of thebucket, the substeps of  calculating probability P{state=0 & counter=i}at time=t+1,  calculating probability P{state=1 & counter=i} attime=t+1,  calculating probability P{counter hitting floor or ceiling}at time=t+1,  calculating component of mean and mean square for durationof measurement at time=t+1,  calculating weight,  preparing for the nextiteration of the loop by shifting values, and ending loop,  calculatingvariance and standard deviation of duration for the measurement, producing probability of hitting floor and hitting ceiling,  producingmean and standard deviation of duration.